Wordpress Slider by 10Web SQL Injection Vulnerability

Wordpress Slider by 10Web is an open source application plugin for Wordpress. Provides a versatile solution for adding a fast loading, responsive and SEO friendly slider to website pages, posts, theme headers or any other location. Slider by 10Web WordPress plugin versions prior to 1.2.36 suffers...

Sql injection

The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user Admin, or medium one such as Contributor+ if "Role Options" is turn on for other users to perform a SQL...

CVE-2021-24139 Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection

Unvalidated input in the Photo Gallery 10Web Photo Gallery WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwgsearchx parameter...

CVE-2021-24132

CVE-2021-24132 affects the WordPress plugin Slider by 10Web up to version 1.2.35; version 1.2.36 fixes it. The root cause is a SQL Injection in the plugin’s admin endpoints (bulk_action, export_full, save_slider_db) exploitable by an authenticated user (Admin or certain Contributor+ roles when en...

Photo Gallery by 10web < 1.5.69 - Reflected Cross-Site Scripting (XSS)

The plugin did not properly sanitise the bwgsearchX GET parameter, available in a frontend gallery when the Show Search Box setting is enabled disabled by default, leading to a reflected Cross-Site Scripting issue PoC Append the below payload in a page with an embedded gallery and the Show Search...

Photo Gallery by 10web < 1.5.69 - Reflected Cross-Site Scripting (XSS)

The plugin did not properly sanitise the bwgsearchX GET parameter, available in a frontend gallery when the Show Search Box setting is enabled disabled by default, leading to a reflected Cross-Site Scripting issue Append the below payload in a page with an embedded gallery and the Show Search Box...

Photo Gallery by 10Web < 1.5.68 - Cross-Site Scripting (XSS)

The Photo Gallery by 10Web WordPress plugin, version 1.5.68 and possibly below, was vulnerable to Cross-Site Scripting XSS in the $breadcrumb attribute variable...

WordPress Slider by 10Web plugin <= 1.2.35 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities

Multiple Authenticated SQL Injection SQLi vulnerabilities found by Nguyen Anh Tien in WordPress Slider by 10Web plugin versions = 1.2.35. Solution Update the WordPress Slider by 10Web plugin to the latest available version at least 1.2.36...

Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection

The bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user Admin, or medium one such as Contributor+ if "Role Options" is turn on for other users to perform a SQL Injection attacks. PoC Vulnerable param: check Vulnerable function:...

Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection

The bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user Admin, or medium one such as Contributor+ if "Role Options" is turn on for other users to perform a SQL Injection attacks. Vulnerable param: check Vulnerable function:...

10Web Social Post Feed < 1.1.27 - Authenticated SQL Injection

Authenticated SQL injection in the 10Web Social Post Feed WordPress Plugin 1.1.26 via the /wordpress/wp-admin/admin.php?page=infoffwd searchvalue parameter. https://drive.google.com/file/d/1Hndhdy3leYTzutx-DJvu1B-tW5Y5teBB/view...

10Web Social Post Feed < 1.1.27 - Authenticated SQL Injection

Authenticated SQL injection in the 10Web Social Post Feed WordPress Plugin 1.1.26 via the /wordpress/wp-admin/admin.php?page=infoffwd searchvalue parameter. PoC https://drive.google.com/file/d/1Hndhdy3leYTzutx-DJvu1B-tW5Y5teBB/view...

WordPress 10Web Social Post Feed plugin <= 1.1.26 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Vu Tien Hoa SunCSR in WordPress 10Web Social Post Feed plugin versions = 1.1.26. Solution Update the WordPress 10Web Social Post Feed plugin to the latest available version at least 1.1.27...

Form Maker by 10Web < 1.13.40 - Authenticated Reflected XSS

The 'Form Maker by 10Web' WordPress plugin is vulnerable to XSS in the 'blockedipsfm' page. A logged-in site administrator who follows a crafted link will trigger arbitrary JavaScript code to be run in their browser in the context of their privileged account on the WordPress site...

WordPress Form Maker by 10Web plugin <= 1.13.39 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Andy Tyler in WordPress Form Maker by 10Web plugin versions = 1.13.39. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.40...

WordPress 10Web Photo Gallery Plugin SQL Injection

An SQL injection vulnerability exists in 10Web Photo Gallery Plugin for WordPress. The vulnerability is due to insufficient sanitization of user input...

WordPress Form Maker 5.4.1 - SQL Injection

WordPress Form Maker plugin versions 5.4.1 and below suffer from a remote SQL injection vulnerability. Exploit Title: WordPress Plugin Form Maker 5.4.1 - 's' SQL Injection Authenticated Exploit Author: SunCSR Sun Cyber Security Research Date: 2020 - 5 - 22 Vender Homepage: https://help.10web.io/...

Form Maker by 10Web < 1.13.36 - Authenticated SQL Injection

Authenticated admin+ SQL injection in the Form Maker by 10Web WordPress Plugin 1.13.35 exists via the /wordpress/wp-admin/admin.php?page=blockedipsfm=1" s parameter. Edit WPScanTeam: - Initial reported version 5.4.1 does not exist, confirmed to be 1.13.35 by researcher - May 25th, 2020 - details...

Wordpress Form Maker 5.4.1 Plugin - (s) SQL Injection (Authenticated) Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Form Maker 5.4.1 - 's' SQL Injection Authenticated Exploit Author: SunCSR Sun Cyber Security Research Vender Homepage: https://help.10web.io/ Version: = 5.4.1 Tested on: Ubuntu 18.04 Description: SQL injection i...

WordPress Form Maker by 10Web plugin <= 1.13.35 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Vu Tien Hoa in WordPress Form Maker by 10Web plugin versions = 1.13.35. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.36...